3803459 - How to respond to NIS2 supply chain security assessments for SAP Customer Data Cloud

Customer requests documentation to complete a security or compliance assessment for SAP Customer Data Cloud (CDC). Common scenarios include:

• EU NIS2 Directive (Network and Information Security Directive 2022/2505) — supply chain ICT risk management (Article 21)
• DORA (Digital Operational Resilience Act) supplier assessments
• Internal TPRM (Third Party Risk Management) questionnaires
• Procurement / vendor onboarding security reviews

Typical questions include:

• What High Availability (HA) guarantees does SAP provide for CDC?
• How does SAP handle patching and updating of CDC infrastructure?
• What security certifications does SAP CDC hold?
• Where is customer data hosted and how is it protected?
• What is SAP's incident response / breach notification process?

NIS2, NIS 2, supply chain, TPRM, vendor assessment, high availability, HA, SLA, patching, patch management, maintenance window, ISO 27001, SOC 2, Trust Center, security certification, compliance, DORA, cybersecurity , KBA , CEC-PRO-SYS , System (Network, Performance, SMTP, Rate Limits, Latency) , Problem